CVE-2026-11787

A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.

Red Hat rates this issue as Moderate impact. In 389-ds-base, internal text-based LDAP filter parsing can read up to six bytes before a heap buffer when a filter string has = at or near the start. Production builds do not crash; the practical effect is silent filter misparse—search results may be wrong, including where ACIs use targetfilter.

This path is not reached by normal LDAP search filters on the wire (BER-encoded filters use a separate parser). An attacker must influence internal filter strings—for example plugin configuration (originFilter, nsUniqueAttribute), ACI definitions, or replication-delivered config. NVD rates this 6.3 (AC:L); Red Hat rates 5.0 (AC:H, PR:L) because exploitation requires those internal paths, not direct network filter injection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No direct workaround addresses the code-level bug; network-level mitigations (proxies, WAFs, filter validation) do not apply. Mitigation measures to reduce exposure: restrict plugin configuration access (MEP originFilter, UID uniqueness nsUniqueAttribute, strict ACIs on cn=config); restrict Directory Manager access for ACI, MEP, or uniqueness plugin configuration; harden replication topology to restrict replication peers; monitor for anomalous search result sets that may indicate exploitation.